Hi, has anyone done any work around this file, I researched it a bit on google, but there is no mention of the contents of this particular file, more its the thumnailcache that is discussed. I dont know if i'm right but to me this appears to be a link file back to the thumbnailcache. Only thing is the one I'm looking at has a number of files within it with no file ext, the titles are 2 or 3 digit numbers starting with 0, they are all the same size 78,848 bytes, and none contain the same pattern of data as any others, ie there appears to be no uniformity to each file, although in some there is a repeating pattern within the file its self. There appears to be no plain text contained and nothing I can resolve as a date stap either. any information would be appreciated.
Thanx
Griff
What software are you using? If EnCase, try right click>view file structure…this may give you something usable.
I just gave this a try..nothing spectacular….it is a Compound Volume and as expected the view after mounting shows the MFT, Big and Small block and a root entry. I tried viewing the data with multiple styles and formats…nothing useful. Do you have an MD5 HASH on it; it may be a static file that came with Vista. The hash I Have is 72f5c05b7ea8dd6059bf59f50b22df33.
Hi Anti-Curse
Thanx for the reply Im back at work Mon so I'll try the hash, incidentally yes it's EnCase 6.11.
Griff